A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.

TOP VULNERABILITY THIS WEEK: A new zero-day attack for Adobe Acrobat
Reader X has been discovered, according to Russian firm Group-IB. While
attacks to date appear to be limited, due to the need for user
interaction before exploitation can take place, it can be assumed that
underground researchers are working on a mechanism to automate the
exploit, so that it can be used in drive-by downloads and exploit kits.

- --SANS Security East 2013 New Orleans, LA January 16-23, 2013
11 courses. Bonus evening presentations include The Next Wave - Data
Center Consolidation; Top Threats to Cloud for 2013; and Hacking Your
Friends and Neighbors for Fun. Special Event: NetWars Tournament of
Champions.http://www.sans.org/event/security-east-2013

- --North American SCADA and Process Control Summit 2013 Lake Buena Vista, FL February 6-13, 2013
The Summit brings together the program managers, control systems
engineers, IT security professionals and critical infrastructure
protection specialists from asset owning and operating organizations
along with control systems and security vendors who have innovative
solutions for improving security. The Security Summit is an action
conference designed so that every attendee leaves with new tools and
techniques they can put to work immediately when they return to their
office. The Summit is the place to come and interact with top SCADA
experts, key government personnel, researchers and asset owners at the
multiple special networking events.
8 courses. Bonus evening presentation: The SANS SCADA Dinner Theater
Players Present: From Exposure to Closure - Act III.http://www.sans.org/event/north-american-scada-2013

Title: Adobe Flash 0-Day
Description: A new Adobe Acrobat Reader X memory corruption
vulnerability was recently announced by Group-IB, a Russian
cybersecurity firm. While initial reports were that it was to be added
to the Blackhole Exploit Kit immediately, researchers soon noted that
exploiting the bug required manual user interaction - specifically, the
malicious file would have to be closed like a normal document - which
would make it unsuitable for Blackhole and other automated exploitation
systems. Exploits have been limited in the wild thus far, but given the
difficulty of bypassing Adobe's recently added sandboxing and other
security features, cybercriminals are likely working on ways to automate
exploitation already. As no patch currently exists, potentially
vulnerable users should exercise caution when opening potentially
suspicious PDF documents.
Reference:http://group-ib.com/index.php/7-novosti/672-group-ib-us-zero-day-vulnerability-found-in-adobe-x
Snort SID: 24721, 24722
ClamAV: N/A

Title: 64-bit Linux Rootkit Uses Novel Techniques
Description: A new type of 64-bit Linux rootkit was discovered in the
wild last week, after an infected user posted details from an infected
server on the Full-Disclosure mailing list. The rootkit was found
injecting malicious iframes into all HTTP responses served up by the
victim's nginx web server, a popular open-source, lightweight system
programmed by Russian-based company Nginx, Inc. This technique, which
can easily be used to assist in drive-by downloads and other exploit kit
style behavior, is a fascinating new twist on cybercriminals' efforts
to continue infecting large swaths of the public for use in worldwide
botnets.
Reference:http://blog.crowdstrike.com/2012/11/http-iframe-injecting-linux-rootkit.htmlhttp://seclists.org/fulldisclosure/2012/Nov/94
Snort SID: N/A
ClamAV: UNIX.Trojan.Snakso

Title: Novell File Reporter 0-Day Exploits Available in Metasploit
Description: Multiple remote file retrieval vulnerabilities plus a
remote code execution bug were announced last week in Novell's File
Reporter software, used for coordinating data storage across multiple
filesystems and/or storage solutions. The vulnerabilities have already
been added to Metasploit, and as no patch currently exists, exploits are
presumed to be occurring in the wild. Potentially impacted customers are
urged to firewall off their devices appropriately until a patch is
released.
Reference:http://www.kb.cert.org/vuls/id/273371https://community.rapid7.com/community/metasploit/blog/2012/11/16/nfr-agent-buffer-vulnerabilites-cve-2012-4959
Snort SID: 24765 - 24767
ClamAV: N/A

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

(c) 2012. All rights reserved. The information contained in this
newsletter, including any external links, is provided "AS IS," with no
express or implied warranty, for informational purposes only.

Please feel free to share this with interested parties via email, but
no posting is allowed on web sites. For a free subscription, (and for
free posters) or to update a current subscription, visit
https://www.sans.org/account